What actually happens when you connect your domain

A process that ends with typing one CNAME record actually spans four layers: DNS, certificate, edge and the application itself. Knowing which step does what makes the "my site is down" moment much shorter.

Your application gets an address the moment it is deployed, and it is reachable straight away. But most projects want to go live on their own domain. From the outside that switch looks like a single DNS record; behind it there are four layers.

1. DNS: pointing the name at an address

The first step is making your domain point at us, which you do with a CNAME record. Propagation is not instant; depending on your provider and the lifetime of the previous record it can take minutes.

The most common mistake at this step is adding the new CNAME without removing an old A record. If both exist, which answer is returned becomes unpredictable and the site starts "working sometimes".

2. Certificate: the address must open over HTTPS

Once the domain reaches us, a TLS certificate has to be issued for that name. This is not your job — validation and renewal run automatically. But issuing requires step one to be finished, which is why seeing an HTTPS error before DNS has propagated is normal.

3. Edge: the first stop of a request

A visitor request does not go straight to the box running your application; it lands on the edge layer first. The edge does three things: routes the request to the right application, serves static content quickly, and keeps infrastructure interstitial pages away from your visitors.

That last point looks small but matters: the infrastructure layer has its own waiting pages, and during a deployment they can be shown to a visitor. We catch and hide them at the edge, so the only brand your customer sees is yours.

4. Application: the Host header question

The final layer is the application itself. Applications decide which site they are by looking at the Host header of the incoming request. In setups that host several sites in one box, forwarding that header correctly is critical; get it wrong and the request reaches the right box but shows the wrong site.

It did not connect — now what?

Check in order, because the layers stack: is the domain pointing at us, has the certificate been issued, does the edge recognise the request, is the application opening the right site. The fault is almost always the lowest step that was never completed.

A practical tip: if a freshly connected domain misbehaves, first make sure the old DNS records were really removed. Most problems start at that step, and that is also where they are noticed last.

Other posts